Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0009500Openbravo ERPA. Platformpublic2009-06-16 16:322009-07-16 17:55
Reportershuehner 
Assigned Toshuehner 
PrioritynormalSeveritymajorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Versionpi 
Target VersionFixed in Version 
Merge Request Status
Review Assigned To
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0009500: Add infrastructure to VariablesBase class to allow for technical validation of request parameters
DescriptionAdd new get*Parameter function which allow to validate the data read from the request to ensure that they conform to the expected format (i.e. if they are a list of id's, columnnames, etc.).
Steps To Reproduce
Proposed Solution
Additional Information
TagsNo tags attached.
Relationships
related to defect 0009578 closed shuehner When doing install.source some warnings appear 
blocks defect 0009145 closed shuehner SQL injection in Report Invoice Discount 
blocks defect 0009501 closed shuehner Audit all xsql to ensure that all xsql-parameters of type argument/replace are properly validated -part1 
blocks defect 0009074 closed shuehner SQL injection in datagrid code 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2009-06-16 16:32shuehnerNew Issue
2009-06-16 16:32shuehnerAssigned To => shuehner
2009-06-16 16:33shuehnerRelationship addedblocks 0009101
2009-06-16 16:33shuehnerRelationship addedblocks 0009145
2009-06-16 16:40shuehnerRelationship addedblocks 0009501
2009-06-17 17:48hgbotCheckin
2009-06-17 17:48hgbotNote Added: 0017389
2009-06-17 17:48hgbotStatusnew => resolved
2009-06-17 17:48hgbotResolutionopen => fixed
2009-06-17 17:48hgbotFixed in SCM revision => http://code.openbravo.com/erp/devel/pi/rev/f0eaa140a3143b633612c383a44d2977d9707b0b [^]
2009-06-17 17:52hgbotCheckin
2009-06-17 17:52hgbotNote Added: 0017390
2009-06-17 17:52hgbotFixed in SCM revisionhttp://code.openbravo.com/erp/devel/pi/rev/f0eaa140a3143b633612c383a44d2977d9707b0b [^] => http://code.openbravo.com/erp/devel/pi/rev/2a0efc182c89a43a87dbeca02eca95e2074a902b [^]
2009-06-17 18:24shuehnerRelationship addedblocks 0009074
2009-06-17 18:24shuehnerRelationship deletedblocks 0009101
2009-06-22 11:57shuehnerRelationship addedrelated to 0009578
2009-07-11 08:22pjuvaraStatusresolved => closed
2009-07-16 17:55anonymoussf_bug_id0 => 2822566

Notes
(0017389)
hgbot   
2009-06-17 17:48   
Repository: erp/devel/pi
Changeset: f0eaa140a3143b633612c383a44d2977d9707b0b
Author: Stefan Hühner <stefan.huehner <at> openbravo.com>
Date: Wed Jun 17 17:47:51 2009 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/f0eaa140a3143b633612c383a44d2977d9707b0b [^]

Fixed 9500: Add infrastructure to filter request parameter values
- Allows optional validation of request parameters, to check if they conform to the expected format

---
M src-core/src/org/openbravo/base/VariablesBase.java
A src-core/src/org/openbravo/base/filter/IsIDFilter.java
A src-core/src/org/openbravo/base/filter/IsPositiveIntFilter.java
A src-core/src/org/openbravo/base/filter/RegexFilter.java
A src-core/src/org/openbravo/base/filter/RequestFilter.java
A src-core/src/org/openbravo/base/filter/ValueListFilter.java
---
(0017390)
hgbot   
2009-06-17 17:52   
Repository: erp/devel/pi
Changeset: 2a0efc182c89a43a87dbeca02eca95e2074a902b
Author: Stefan Hühner <stefan.huehner <at> openbravo.com>
Date: Wed Jun 17 17:52:42 2009 +0200
URL: http://code.openbravo.com/erp/devel/pi/rev/2a0efc182c89a43a87dbeca02eca95e2074a902b [^]

Issue 9500: Convert parameter validation in selector code to use new request filter code

---
M src/org/openbravo/erpCommon/info/Account.java
M src/org/openbravo/erpCommon/info/AccountElementValue.java
M src/org/openbravo/erpCommon/info/BusinessPartner.java
M src/org/openbravo/erpCommon/info/BusinessPartnerMultiple.java
M src/org/openbravo/erpCommon/info/DebtPayment.java
M src/org/openbravo/erpCommon/info/Invoice.java
M src/org/openbravo/erpCommon/info/InvoiceLine.java
M src/org/openbravo/erpCommon/info/Locator.java
M src/org/openbravo/erpCommon/info/Product.java
M src/org/openbravo/erpCommon/info/ProductComplete.java
M src/org/openbravo/erpCommon/info/ProductMultiple.java
M src/org/openbravo/erpCommon/info/Project.java
M src/org/openbravo/erpCommon/info/SalesOrder.java
M src/org/openbravo/erpCommon/info/SalesOrderLine.java
M src/org/openbravo/erpCommon/info/SelectorUtility.java
M src/org/openbravo/erpCommon/info/ShipmentReceipt.java
M src/org/openbravo/erpCommon/info/ShipmentReceiptLine.java
---